login[.]rustfoundry[.]net

The domain login.rustfoundry.net was observed serving a page titled “Zaloguj się” and is attributed to a Steam brand impersonation campaign. The domain was registered on November 08, 2025 through Web Commerce Communications Limited and is hosted on the IP address 185.178.208.158, which belongs to AS57724 (DDOS‑GUARD LTD) in Russia. DNS resolution points to the authoritative nameservers ns1.ddos-guard.net and ns2.ddos-guard.net. No TLS certificate is presented, indicating the site is served over plain HTTP. The site has been listed on a single security blocklist and was actively blocked by the PhishDestroy service.

Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a highly malicious assessment. VirusTotal analysis shows that 14 of 95 scanned security vendors flagged the domain as malicious. The page title “Zaloguj się” is Polish for “Log in”, which aligns with typical credential‑harvesting tactics. The current operational status is offline, suggesting the infrastructure has been taken down or is no longer serving content.

Analysis confirms the domain’s primary purpose is credential harvesting targeting Steam users, leveraging a localized login prompt. Evidence does not disclose the underlying phishing kit or any additional payloads, and no further host activity has been observed beyond the listed IP. Defenders should continue to block the domain at DNS and proxy layers, monitor for re‑registration attempts, and incorporate the IP address and nameserver information into threat‑intelligence feeds. Ongoing vigilance is advised, as the actors may replicate the campaign using new domains or alternative hosting services.